How to redact emails for a subject access request

Work out whose mailboxes are likely to hold the requester’s personal data, then export them. Search deleted and trash folders too: GOV.UK guidance for schools lists them as in scope.

• Microsoft 365 and Outlook

  Run an eDiscovery search in Microsoft Purview and export the results as .pst. See exporting from Microsoft Purview. For a single mailbox you can also use Outlook’s File → Open & Export → Import/Export.

• Google Workspace and Gmail

  Export the accounts from Google Vault in MBOX format. See exporting from Google Vault.

• Individual emails

  Single messages saved as .eml or .msg work too, as do PDFs.

Keep the original export somewhere secure and unchanged. You will redact a copy.

Exports from several mailboxes overlap: one email sits in the sender’s Sent items and in every recipient’s Inbox. Remove the copies before you start reading, so each email is reviewed once and redacted the same way. RedactBox groups copies by their Message-ID across every file you upload and lets you keep one. How duplicate detection works.

Search for every way the requester is identified: full name, first name on its own, nicknames, initials, email addresses and any reference numbers your organisation uses. Then go through what you have and set aside anything that is not about them.

The right of access is to their personal data, not to whole documents. An email that only mentions them in passing may need just that part disclosed.

Emails about one person are full of other people: colleagues on the CC line, family members, other customers or pupils. For each, consider whether they have consented, or whether it is reasonable to disclose their information without consent, taking account of any duty of confidentiality and how sensitive it is. If not, redact it. Make the call case by case and write down why.

• Names in quoted replies and forwarded threads

  The same name often appears many times in one email.

• To, CC and From lines, and email signatures

  Addresses and phone numbers in signatures are easy to miss.

• Indirect identifiers

  A job title, a class, or a detail that identifies someone without naming them.

In RedactBox, search for a name and redact every match across the whole request in one pass, reviewing each in context first. People Detection lists everyone who sent or received a message, so you can decide once per person, and word lists save the names for the next request.

Attachments often hold the most sensitive information in a request: reports, minutes, spreadsheets. Decide which are in scope and redact them as documents in their own right.

Before anything goes out, check two things: that nothing has been missed, and that the redactions are permanent. A black box drawn over text, or text highlighted black, can often be lifted off.

RedactBox lists possibly missed redactions (approved items with nothing redacted that still contain a term you have redacted elsewhere). Exported PDFs have the text removed, and any document where redacted text would still show is held back for you to fix. Each project gives you a Schedule of Redactions to send with the response, listing what was redacted and why without revealing it.

Your response should also include your DPO’s contact details, how to complain to the ICO, and the requester’s right to seek a judicial remedy. Send it securely.

Keep a record of the request from start to finish: when it arrived, any ID or clarification, what you searched, and why you redacted what you did. Keep the unredacted and redacted versions in case the response is reviewed. RedactBox keeps a CSV audit log of every redaction with who made it. Audit trail.